Chapter 12. Configuring RHEL as a wifi access point

On a host with a wifi device, you can use NetworkManager to configure this host as an access point. Wireless clients can then use the access point to connect to services on the RHEL host or in the network.

When you configure an access point, NetworkManager automatically:

  • Configures the dnsmasq service to provide DHCP and DNS services for clients
  • Enables IP forwarding
  • Adds nftables firewall rules to masquerade traffic from the wifi device and configures IP forwarding

12.1. Identifying whether a wifi device supports the access point mode

To use a wifi device as an access point, the device must support this feature. You can use the nmcli utility to identify if the hardware supports access point mode.


  • A wifi device is installed on the host.


  1. List the wifi devices to identify the one that should provide the access point:

    # nmcli device status | grep wifi
    wlp0s20f3    wifi   disconnected    --
  2. Verify that the device supports the access point mode:

    # nmcli -f WIFI-PROPERTIES.AP device show wlp0s20f3

12.2. Configuring RHEL as a WPA2 or WPA3 Personal access point

Wi-Fi Protected Access 2 (WPA2) and Wi-Fi Protected Access 3 (WPA3) Personal provide secure authentication methods in wireless networks. Users can connect to the access point using a pre-shared key (PSK).


  • The wifi device supports running in access point mode.
  • The wifi device is not in use.
  • The host has internet access.


  1. Install the dnsmasq and NetworkManager-wifi packages:

    # dnf install dnsmasq NetworkManager-wifi

    NetworkManager uses the dnsmasq service to provide DHCP and DNS services to clients of the access point.

  2. Create the initial access point configuration:

    # nmcli device wifi hotspot ifname wlp0s20f3 con-name Example-Hotspot ssid Example-Hotspot password "password"

    This command creates a connection profile for an access point on the wlp0s20f3 device that provides WPA2 and WPA3 Personal authentication. The name of the wireless network, the Service Set Identifier (SSID), is Example-Hotspot and uses the pre-shared key password.

  3. Optional: Configure the access point to support only WPA3:

    # nmcli connection modify Example-Hotspot 802-11-wireless-security.key-mgmt sae
  4. By default, NetworkManager uses the IP address for the wifi device and assigns IP addresses from the remaining subnet to clients. To configure a different subnet and IP address, enter:

    # nmcli connection modify Example-Hotspot ipv4.addresses

    The IP address you set, in this case, is the one that NetworkManager assigns to the wifi device. Clients will use this IP address as default gateway and DNS server.

  5. Activate the connection profile:

    # nmcli connection up Example-Hotspot


  1. On the server:

    1. Verify that NetworkManager started the dnsmasq service and that the service listens on port 67 (DHCP) and 53 (DNS):

      # ss -tulpn | egrep ":53|:67"
      udp   UNCONN 0  0*    users:(("dnsmasq",pid=55905,fd=6))
      udp   UNCONN 0  0*    users:(("dnsmasq",pid=55905,fd=4))
      tcp   LISTEN 0  32*    users:(("dnsmasq",pid=55905,fd=7))
    2. Display the nftables rule set to ensure that NetworkManager enabled forwarding and masquerading for traffic from the subnet:

      # nft list ruleset
      table ip nm-shared-wlp0s20f3 {
          chain nat_postrouting {
              type nat hook postrouting priority srcnat; policy accept;
              ip saddr ip daddr != masquerade
          chain filter_forward {
              type filter hook forward priority filter; policy accept;
              ip daddr oifname "wlp0s20f3" ct state { established, related } accept
              ip saddr iifname "wlp0s20f3" accept
              iifname "wlp0s20f3" oifname "wlp0s20f3" accept
              iifname "wlp0s20f3" reject
              oifname "wlp0s20f3" reject
  2. On a client with a wifi adapter:

    1. Display the list of available networks:

      # nmcli device wifi
      IN-USE  BSSID              SSID             MODE   CHAN  RATE      SIGNAL  BARS  SECURITY
              00:53:00:88:29:04  Example-Hotspot  Infra  11    130 Mbit/s  62      ▂▄▆_  WPA3
    2. Connect to the Example-Hotspot wireless network. See Managing Wi-Fi connections.
    3. Ping a host on the remote network or the internet to verify that the connection works:

      # ping -c 3

Additional resources